diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index b33ac1009..9ffafb99f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -173,7 +173,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v1.5.16 + uses: scribe-security/action-bom@v1.5.18 with: target: 'busybox:latest' ``` @@ -181,7 +181,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v1.5.16 + uses: scribe-security/action-bom-cli@v1.5.18 with: target: 'hello-world:latest' ``` @@ -320,6 +320,47 @@ jobs: +### Mapping the DOCKER_CONFIG Environment Variable + +When using a job's Docker daemon to pull private images, you might need to log in to your private registry before running **valint**. To ensure that the containerized action `action-bom` can access your private image, set `DOCKER_CONFIG` to a directory in your workflow that is accessible for mapping. + +Below is an example configuration: + +```yaml +env: + DOCKER_CONFIG: ${{ github.workspace }}/.docker + +steps: + - name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ${{ env.REGISTRY_URL }} + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + + - name: Generate cyclonedx json SBOM + uses: scribe-security/action-bom@master + with: + target: 'scribesecurity/example:latest' +``` + +Alternatively, you can use uncontainerized actions directly: + +```yaml +- name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ${{ env.REGISTRY_URL }} + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + +- name: Generate cyclonedx json SBOM + uses: scribe-security/action-bom-cli@master + with: + target: 'scribesecurity/example:latest' + format: json +``` + ### Running action as non root user By default, the action runs in its own pid namespace as the root user. You can change the user by setting specific `USERID` and `USERNAME` environment variables. @@ -464,7 +505,7 @@ Create SBOM for image hosted by a private registry. ```YAML env: - DOCKER_CONFIG: $HOME/.docker + DOCKER_CONFIG: ${{ github.workspace }}/.docker steps: - name: Login to GitHub Container Registry uses: docker/login-action@v2 @@ -477,7 +518,7 @@ steps: uses: scribe-security/action-bom@master with: target: 'scribesecurity/example:latest' - force: true + ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 6de195652..b8157882f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -138,7 +138,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v1.5.16 + uses: scribe-security/action-evidence@v1.5.18 with: target: some_file.json ``` @@ -146,7 +146,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v1.5.16 + uses: scribe-security/action-evidence-cli@v1.5.18 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 6c881b971..c125c10c7 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -157,7 +157,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v1.5.16 + uses: scribe-security/action-slsa@v1.5.18 with: target: 'busybox:latest' ``` @@ -165,7 +165,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v1.5.16 + uses: scribe-security/action-slsa-cli@v1.5.18 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index e8263bbfd..c1dcb1b5b 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v1.5.16 + uses: scribe-security/action-verify@v1.5.18 with: target: 'busybox:latest' ``` @@ -177,7 +177,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v1.5.16 + uses: scribe-security/action-verify-cli@v1.5.18 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/gitlabci.md b/docs/integrating-scribe/ci-integrations/gitlabci.md index 3969ebd57..2204f4e83 100644 --- a/docs/integrating-scribe/ci-integrations/gitlabci.md +++ b/docs/integrating-scribe/ci-integrations/gitlabci.md @@ -112,6 +112,8 @@ custom-ntia-metadata: - valint bom busybox --context-type gitlab --output-directory ./scribe/valint + --author-name bom --author-email bob@company.com + --supplier-name alice --supplier-url company2.com --supplier-email alice@company2.com --supplier-phone 001 ``` diff --git a/docs/platforms/github-integration.md b/docs/platforms/github-integration.md index 22f5da5c3..a7af8ae92 100644 --- a/docs/platforms/github-integration.md +++ b/docs/platforms/github-integration.md @@ -79,7 +79,7 @@ env: LOG_LEVEL: "INFO" VALINT_SCRIBE_ENABLE: true DOCKER_DRIVER: overlay2 - DOCKER_CONFIG: $HOME/.docker + DOCKER_CONFIG: ${{ github.workspace }}/.docker DOCKERHUB_USERNAME: scribesecurity SCRIBE_PRODUCT_VERSION: "v0.0.2-github" diff --git a/docs/valint/getting-started-valint.md b/docs/valint/getting-started-valint.md index 885a8f4b4..ad9923716 100644 --- a/docs/valint/getting-started-valint.md +++ b/docs/valint/getting-started-valint.md @@ -11,7 +11,7 @@ Valint is a tool used to manage `evidence` generation (for directories, file art Valint also enables you to **capture** any 3rd party report, scan or configuration (any file) into evidence. -> Latest Version `v1.5.16`. +> Latest Version `v1.5.18`. ### Installing Valint